CVE-2026-72175 addresses a race condition in the Linux kernel's fs/proc/task_mmu component, specifically in the make_uffd_wp_huge_pte() function. The vulnerability arises because the function arms the UFFD_WP bit on a present HugeTLB PTE by calling huge_ptep_modify_prot_commit() without first calling huge_ptep_modify_prot_start(), which is necessary to atomically clear the entry and maintain a consistent snapshot. Without this atomic operation, hardware Dirty or Accessed bits set between the read and commit can be overwritten with stale data, losing hardware updates. The patch mirrors the correct pattern used for non-hugetlb pages, ensuring the snapshot remains consistent and preventing loss of hardware updates during write-protection changes.

The vulnerability could cause loss of hardware Dirty and Accessed bit updates on huge page table entries during write-protection operations. This may affect kernel memory management accuracy and could potentially lead to incorrect behavior in memory tracking or page fault handling. There is no indication of direct code execution or privilege escalation from this issue alone.

This vulnerability has been resolved by an official patch that corrects the atomic update sequence in make_uffd_wp_huge_pte(). Users should apply the updated Linux kernel versions containing this fix. Since this is a kernel-level fix, updating to the patched kernel version is the recommended mitigation. Patch status is not explicitly stated in the input data; therefore, check the vendor advisory or Linux kernel stable release notes for the exact fixed versions and apply updates accordingly.